fix(sdk): add null checks and consolidate token tests

Address CodeRabbit review:
- Add Objects.requireNonNull to all four factory methods
- Consolidate forToken tests into a parameterized test
- Add null-input contract test

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Mary Dickson <mary.dickson@virtru.com>

Author: marythought

sdk/src/main/java/io/opentdf/platform/sdk/EntityIdentifiers.java

@@ -5,6 +5,8 @@
 import io.opentdf.platform.entity.EntityChain;
 import io.opentdf.platform.entity.Token;
 
+import java.util.Objects;
+
 /**
  * Convenience constructors for {@link EntityIdentifier}, mirroring the Go SDK helpers
  * in {@code authorization/v2.ForEmail}, {@code ForClientID}, etc.
@@ -33,6 +35,7 @@ private EntityIdentifiers() {}
      * Returns an EntityIdentifier for a subject identified by email address.
      */
     public static EntityIdentifier forEmail(String email) {
+        Objects.requireNonNull(email, "email must not be null");
         return fromEntity(Entity.newBuilder()
                 .setEmailAddress(email)
                 .setCategory(Entity.Category.CATEGORY_SUBJECT)
@@ -43,6 +46,7 @@ public static EntityIdentifier forEmail(String email) {
      * Returns an EntityIdentifier for a subject identified by client ID.
      */
     public static EntityIdentifier forClientId(String clientId) {
+        Objects.requireNonNull(clientId, "clientId must not be null");
         return fromEntity(Entity.newBuilder()
                 .setClientId(clientId)
                 .setCategory(Entity.Category.CATEGORY_SUBJECT)
@@ -53,6 +57,7 @@ public static EntityIdentifier forClientId(String clientId) {
      * Returns an EntityIdentifier for a subject identified by username.
      */
     public static EntityIdentifier forUserName(String userName) {
+        Objects.requireNonNull(userName, "userName must not be null");
         return fromEntity(Entity.newBuilder()
                 .setUserName(userName)
                 .setCategory(Entity.Category.CATEGORY_SUBJECT)
@@ -64,6 +69,7 @@ public static EntityIdentifier forUserName(String userName) {
      * The authorization service parses the token to derive the entity chain.
      */
     public static EntityIdentifier forToken(String jwt) {
+        Objects.requireNonNull(jwt, "jwt must not be null");
         return EntityIdentifier.newBuilder()
                 .setToken(Token.newBuilder().setJwt(jwt).build())
                 .build();

sdk/src/test/java/io/opentdf/platform/sdk/EntityIdentifiersTest.java

@@ -53,21 +53,21 @@ void forUserName(String userName) {
         assertEquals(Entity.Category.CATEGORY_SUBJECT, e.getCategory());
     }
 
-    @Test
-    void forToken() {
-        String jwt = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.test";
+    @ParameterizedTest
+    @ValueSource(strings = {"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.test", ""})
+    void forToken(String jwt) {
         EntityIdentifier eid = EntityIdentifiers.forToken(jwt);
 
         assertEquals(EntityIdentifier.IdentifierCase.TOKEN, eid.getIdentifierCase());
         assertEquals(jwt, eid.getToken().getJwt());
     }
 
     @Test
-    void forTokenEmptyString() {
-        EntityIdentifier eid = EntityIdentifiers.forToken("");
-
-        assertEquals(EntityIdentifier.IdentifierCase.TOKEN, eid.getIdentifierCase());
-        assertEquals("", eid.getToken().getJwt());
+    void nullInputsThrow() {
+        assertThrows(NullPointerException.class, () -> EntityIdentifiers.forEmail(null));
+        assertThrows(NullPointerException.class, () -> EntityIdentifiers.forClientId(null));
+        assertThrows(NullPointerException.class, () -> EntityIdentifiers.forUserName(null));
+        assertThrows(NullPointerException.class, () -> EntityIdentifiers.forToken(null));
     }
 
     private static EntityChain extractEntityChain(EntityIdentifier eid) {